LegionLoader: msiexec.exe Spawning cmd.exe Executing Batch Script from AppData\Roaming

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where the Windows Installer (msiexec.exe) initiates potentially suspicious child processes such as cmd.exe, rundll32.exe, or 7z.exe, particularly when these executions involve paths commonly associated with staging or executing malicious payloads, such as the AppData directory, temporary folders, or MSI installer subdirectories.